‘ategory of personal data 





lSource of the data 


Why we processit 


How long we keep this data 





[Our lawful basis for 
processing 


etails relating to lawful basis (where applicable) 






(where appropriate) 








[Criminal conviction grounds (further information) 








Details of prizes, scholarships, bursaries, including 
details of the recipients and donors. 


We obtain this data from 
the University of Oxford 
We obtain this data from 
you 
Wegenerate this data 
about you 

Third party 


Werecord prizes, scholarships, and bursaries 
awarded, including details ofthe recipients and 
donors. In addition to keeping a record of monies 
received and distributed, weare required to 
provide appropriate updates to donors regarding 
{the use of their donations, and we facilitate 
communications between communities of 
scholars, and between donors and recipients. We 
also retain the information as part of the ongoing 
deep relationship and communications between 
the College and individual Old Members, 


Permanently. 


Processing isnecessary for 
the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 


We havea legitimate interest in recording and 
retaining data on monies received and distributed. 
We, our Old Members, and other donors, havea 
legitimate interest in our holding information 
pertinent to the ongoing deep relationship and 
communications between us. Donors also havea 
legitimate interest in understanding the use(s) to 
which their contributions are put. 





\Criminal Conviction Grounds 
N/A 























[Contact details (name, current and historic We obtain this data from |In order to beable to contact Old Membersand __ |Permanently. Processingisnecessary for |We, and you, have a legitimate interest in the N/A N/A 
addresses, telephone numbers), asamended from  |the University of Oxford [continue to develop the ongoing relationship the purposes of our or College maintaining contact information in order 
time to time. We obtain this data from | between the College and its Old Members. We someone else's legitimate [to facilitate communication between us. 
you continue to hold historic addresses to facilitate interests, except where 
Third party contact, as they often remain valid addresses for overridden by your data 
contact, and may represent additional properties protection rights and 
used by an Old Member. They also assist in our freedoms 
checks on the accuracy of our records. 
(Graduation ceremony applications (excluding  |Weobtain this data from |To enable you to attend your graduation. These records will beretainedfor [Processing isnecessaryfor |Wehavea legitimate interest in the retention of |N/A N/A 
dietary information), related correspondence. [you oneyear fromthedateonwhich _ performance of our contract | this data for a period following your graduation 
Wegenerate this data the ceremony took place. with you ceremony, asit may be relevant to respond to 
about you queries, or for administrative purposes. 
Processing is necessary for 
the performance of a task 
carried out in the public 
interest 
Processing is necessary for 
the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 
Legacy documentation, including correspondence |We obtain this data from |As a record of amounts and documentation Details ofalegator'sidentity, the |Processingisnecessary for |The College has a legitimate interest in seeking |N/A N/A 
with futureand prospective legators, copiesof [you relating to future/proposed donations, to enable amount of any legacy, andtheuse |compliancewithalegal [legacy donations, holding a record of expected 
relevant wills or sections of wills. Wegeneratethisdata _ | theefficient transfer of relevant funds at the {to which it was put will bestored [obligation legacy donations, thanking legators and their 
about you appropriate time, and to enable the College to plan |by the College and/or University in families, and having materials available to 
for the future. Wealso store and use this perpetuity. Wherea legacy Processingisnecessary for |demonstrate the College's interests in such funds. 
information so that the College/Universitycan [contains conditions, directions or _|the purposes of our or 
accurately follow the wishes and intentions of Old [is subject to a dispute, we will someone else's legitimate 
Members/supporters who indicate that they will [retain all information held interests, except where 
beleavinga legacy. In addition, details of pertaining to that legacy until (a) [overridden by your data 
proposed legators will be used to thank legators |15 yearsfollowingtheendofthe | protection rights and 
during their lifetime. dispute or any potential further |freedoms 
disputes, or (b) until the assets 
forming the legacy are exhausted 
(whichever is longer). 
Rights to use College facilities: library accessand |Wegeneratethisdata |To enabletheCollegeto recognise, and foryouto |Detailsto therightsyouhaveas [Processing isnecessary for |We havea legitimate interest in the proper N/A N/A 
borrowing rights; dining rights; reduced ratesfor [about you exercise, your rights as a College Old Member. We |regards College facilities willbe | performance of our contract | operation of College library facilities. We, and you, 
accommodation, etc. also record instances where you haveexercised [held in perpetuity. We with you havea legitimate interest in the accuracy of library 
Your Old Members rights as part of the proper retain records of your exercise of records. 
operation of College library facilities. {those rights/access to facilities for a | Processing is necessary for 
period of [7 years] following the last |the purposes of our or 
instance. someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 
Library records: details of your name, book Wegeneratethisdata _ |To recognise and record the contribution made by |Weretain details of such donations [Processingisnecessary for |We, and you, havea legitimate interest in N/A N/A 
donationsyou have made, and dates of donations |about you individuals to the College. permanently. the purposes of our or recording and recognising the contributions you 
are retained by the College library. someone else's legitimate [have made to the College. 
interests, except where 
overridden by your data 
protection rights and 
freedoms 
Information about your health, dietary [We obtain this data from | When we consider what reasonable adjustments to |Permanently. Processingisnecessary for _|Processingis necessary for compliance with Substantial public Where it processes special category data for these |N/A 


requirements and/or disabilities. 





you 


make, or we need to take account of any dietary 
requirements you have (whether for medical or 
belief reasons), when planning for you attendance 
at Old Members events. In addition, we have an 
obligation to confirm that the College is following 
applicable fundraising policies. Further, if you 
request that we cease to contact you, we will 
record the reason you give (if any) for statistical 
purposes. 











compliance with a legal 
obligation 

Processing is necessary for 
the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 








equality law, and/or food safety law. Weare also 
required to implement and check compliance with 
certain policies regarding our fundraising 
activities. We, and you, also havea legitimate 
interest in ensuring that you receive an 
appropriate service and treatment in your 
interactions with us, including in our ability to 
proactively offer you facilities designed to meet 
your needs. 





interest under the UK 
Data Protection Act 
2018 





purposes, the College is exercising functions 
conferred under the Equality Act 2010 and/or 
pursuant to its obligations under health and safety 
legislation. The processing is necessary for reasons 
of substantial public interest, namely that the 
College must comply with its statutory obligations 
concerning equal opportunity and to make 
reasonable adjustments, and to comply with its 
health and safety obligations. 




















Security records, including CCTV records, access 
control records and records of keys issued. 

Records of security incidents, accident reports and 
health and safety records. 


We generate this data 
about you 


To monitor the attendance of people on College 
premises, events on college premises, and relevant 
incidents occurring, as part of the College's safety 
and security arrangements. 


CCIVrecordsare retained for one 
month. Access, accident, health 
and safety, and similar records are 
retained for 7 years. 


Processing is necessary for 
{the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 


We havea legitimate interest in monitoring the 
attendance of people on College premises, as part 
of the College's safety and security arrangements. 


Substantial public 
interest under the UK 
Data Protection Act 
2018 


To the extent that special category data is 
recorded, this will be done under the substantial 
public interest as being required under an 
enactment or rule of law, or preventing or 
detecting unlawful acts. 


The processing relates to personal data 
that you have manifestly made public 
The processing is necessary in connection 
with legal proceedings (including 
prospective legal proceedings) 

‘The processing is necessary for the 
purpose of obtaining legal advice 

The processing is otherwise necessary for 
establishing, exercising or defending legal 
rights 

‘The processing meets a condition in Part 
2 of Schedule 1 to the Data Protection 
Act 2018 

‘The processing meets a condition in Part 
3 of Schedule 1 to the Data Protection 
Act 2018 
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Records of College cultural life while you attended 
the University: photographs and written records of 
teams, choirs, clubs and societies, plays and 
performances, of participation in events and 
sporting fixtures and of the outcomes. 





We obtain this data from 
the University of Oxford 
We obtain this data from 
you 
Wegenerate this data 
about you 

Third party 


To maintain a record of College life, which may be 
relevant to you individually (for example if you 
later request a reference from us), and which is also 
part of the College's own record of what its 
members have achieved over time. We also add 
the facts of your memberships/interests, activities 
and achievements onto our database, to ensure we 
offer a personalised experience in our relationship 
with you. 


Permanently. 


Processing is necessary for 
{the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 


The College has a legitimate interest in maintaining 
arecord ofits cultural life. We, and you also havea 
legitimate interest in ensuring that we havea 
positive and well-informed ongoing relationship. 


Processing is necessary 
for archiving purposes in 
{the public interest as 
permitted under the UK 
Data Protection Act 


Theresa public interest in the College maintaining 
its archive of College life for future generations, 
andin the context of the College being a College of 
a long-established University with a strong identity 
and history. 


The Collegeis required to implement appropriate 
safeguards for individuals’ rights and freedoms. 
The UK Data Protection Act provides safeguards by 
making specific provision preventing processing 
which is likely to cause substantial damage or 
substantial distress to a data subject; and/or 
which is carried out for the purposes of measures 
or decisions with respect to a particular data 
subject, unless the purposes for which the 
processing is necessary include the purposes of 
approved medical research. 


The processing meetsa condition in Part 
1 of Schedule 1 to the Data Protection 
Act 2018 


Where it processes such data for archiving purposes, the College is 
required to implement appropriate safeguards for individuals’ rights 
and freedoms. The UK Data Protection Act provides safeguards by 
making specific provision preventing processing which is likely to 
cause substantial damage or substantial distress to a data subject; 
and/or which is carried out for the purposes of measures or decisions 
with respect to a particular data subject, unless the purposes for 
which the processing is necessary include the purposes of approved 
medical research. 
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Financial information including your contact 
information and details of invoicing and 
outstanding payments (including payment 
information such as credit card or banking 
payment information) for: accommodation, 
deposits, food and drink, use of sporting and other 
facilities, as we have arranged with you. 


[We obtain this data from 
you 
Wegenerate this data 
about you 


To take and/or pursue outstanding sums due to the 
College. 


Payment and invoicing data will be 
retained for 7 years following date 

of payment. Data may be retained 

for a longer period in the event of a 
dispute. 


Processing is necessary for 
performance of our contract 
with you 

Processing is necessary for 
the performance of a task 
carried out in the public 
interest 


N/A 


N/A 
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[Opinions and comments made by you on College 
development and outreach programs and events, 
as expressed in communications with the College 
(to the extent recorded) 


[We obtain this data from 
you 


‘The views, ideas and concerns of Old Members help 
to guide College development activities. Such 
comments would only be recorded in relation to a 
specific Old Member where we have been clear that 
the relevant survey isnot anonymous, or where the 
relevant opinions were expressed 

in correspondence which is retained. The College 
uses Old Members comments to evaluate the 
success of events, activities, and to shape future 
strategy. 


Permanently. 


Processing is necessary for 
{the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 


Wehavea legitimate interest in operating a 
proactive, positive and engaged development 
program 


N/A 


N/A 
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[Correspondence with you 


[We obtain this data from 
you 


To hold an accurate record of our communications 
with you to ensure we can maintain continuity in 
our lifelong relationship with our Old Members. 


Permanently. 


Processing is necessary for 
{the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 


We, and you, havea legitimate interestsin the 
College holding a full record of our 
correspondence with you, which can be referred 
back to over the course of our relationship. 


N/A 


N/A 
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Donation histories, including contacts made, 
details of amounts given and pledged, projects 
supported, Gift Aid forms (including name, address 
and other details). 


[We obtain this data from 
you 
Wegenerate this data 
about you 


To record the source of monies received, wishes of 
donors, and to hold an accurate record of the 
support donors have provided to the College. We 
may also need to provide some details to HMRC in 
compliance with legal obligations. We 

also recognise our donors for the full spectrum of 
support they provide and seek to keep them 
updated about the projects they have supported, if 
they so wish. 


Wekeepa skeleton record, 
including details of any expressions 
of wish, in perpetuity. Additional 
transaction information is held for 
7 years post donation. 


Processing is necessary for 
compliance with a legal 
obligation 


Processing is necessary for 
the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 


Wehavea legitimate interest in holding records of 
the support you have provided to the College. You 
havea legitimate interest in our recording and 
recognising that support. 


N/A 


N/A 
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Biographical information, including your interests, 
family news, educational history and 
achievements, employment history and current 
role details, and wealth information. 


We obtain this data from 
the University of Oxford 
We obtain this data from 
you 
Wegenerate this data 
about you 

Third party 








To understand your interests, circumstances and 
occupation, in order to deepen our ongoing 
relationship with you. Old Members often provide 
usinformation specifically for the College record 
or as news, which we will also record on our Old 
Members database. We may also be required by 
law, in certain specific circumstances, to process 
this information. 


Permanently. 





Processing is necessary for 
compliance with a legal 
obligation 


Processing is necessary for 
the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 





We havea legitimate interest in pursuing a positive 
longterm relationship with our Old Members. 





Explicit consent 








[We avoid storing any special category data on a 
record relating to religious beliefs or political 
persuasion. However, it is possible that there 
might be information attached to an Old Member's 
record, in a note, in some correspondence from 
the Old Member themselves, etc that could 
providean indication of such beliefs (e.g. letter 
from Reverend on headed paper from Church). 


The processing meetsa condition in Part 
2 of Schedule 1 to the Data Protection 
Act 2018 





Further processing activity carried out by the College which relates 
to criminal offences or allegations involving donors and supporters 
including prospective donors and supporters (for example, in 
relation to money laundering or bribery offences) may also be carried 
lout for the purposes of: 


1. complying with, or assisting other persons to comply with, a 
regulatory requirement which involves the College taking steps to 
establish whether another person has: 

a. committed an unlawful act, or: 

b. been involved in dishonesty, malpractice or other seriously 
improper conduct; and 


2. In the circumstances, the College cannot reasonably be expected 
to obtain your consent to the processing, and the processing is 
necessary for reasons of substantial public interest. 
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Records of your attendance at College and 
University events, and other involvement in 
College life, whilst an Old Member: photographs 
and written records of groups, societies, teams, 
sports events and outcomes. 


[We obtain this data from 
the University of Oxford 
Wegenerate this data 
about you 

Third party 


[To maintain a record of College life, which may be 
relevant to you individually and which isalso part 
of the College's own record of what members have 
achieved over time. 


Permanently. 


Processing is necessary for 
{the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 
freedoms 


The College has a legitimate interest in maintaining 
arecord ofits cultural life. 


Processing is necessary 
for archiving purposes in 
{the public interest as 
permitted under the UK 
Data Protection Act 


Theresa public interest in the College maintaining 
its archive of College life for future generations, 
andin the context of the College being a College of 
a long-established University with a strong identity 
and history. 


The Collegeis required to implement appropriate 
safeguards for individuals’ rights and freedoms. 
The UK Data Protection Act provides safeguards by 
making specific provision preventing processing 
which is likely to cause substantial damage or 
substantial distress to a data subject; and/or 
which is carried out for the purposes of measures 
or decisions with respect to a particular data 
subject, unless the purposes for which the 
processing is necessary include the purposes of 
approved medical research. 


[The processing meetsa condition in Part 
1 of Schedule 1 to the Data Protection 
Act 2018 


Where it processes such data for archiving purposes, the College is 
required to implement appropriate safeguards for individuals' rights 
and freedoms. The UK Data Protection Act provides safeguards by 
making specific provision preventing processing which is likely to 
cause substantial damage or substantial distress to a data subject; 
and/or which is carried out for the purposes of measures or decisions 
with respect to a particular data subject, unless the purposes for 
which the processing is necessary include the purposes of approved 
medical research. 











17 Records generated for legal or statutory We obtain this data from |So that we havea record of information supplied, |For subject accessrequeststhe [Processing is necessary for Substantial public Where it processes special category data for these |The processing meets a condition in Part [Where it processes special category data for these purposes, the 
compliance purposes that contain names and/or |the University of Oxford |both in theinterests of good administration and |Collegewill keeparecordofthe _|compliancewith a legal interest under the UK | purposes, the College is exercising functions 2 of Schedule 1 to the Data Protection [College is exercising functions conferred under legislation. The 
associated personal data. For example, copies of _|We obtain this data from | also to meet legal and regulatory requirements. [SAR output for aperiod oftwo [obligation DataProtection Act [conferred under legislation. The processing is Act 2018 processing is necessary for reasons of substantial public interest, 
data supplied pursuant to requests made under —_|you years following the provision ofthe 2018 necessary for reasons of substantial public interest, namely the requirement for the College to comply with its statutory 
data protection and/or freedom of information _ | Wegenerate this data data to the data subject. namely the requirement for the College to comply and legal obligations. 
legislation, records made to comply with about you with its statutory and legal obligations. 
safeguarding, health and safety or counter- Third party 
terrorism legislation, in connection with legal 
advice or claims, or to comply with auditors’ 
requirements. 

18 Public awards, honours and academic prizes [We obtain this data from |We retain a record of prestigious awards and Permanently. Processingisnecessary for |We, and you, havea legitimate interest is acting to [Processingrelatesto = |To the extent that special category data is relevant, 
received by Old Members. you honours received by our Old Members, to the purposes of our or deepen our relationships with Old Members. We [personal data which you |we only collect and process that data in this 

Third party recognise the achievements of our Old Members someone else's legitimate [also havea legitimate interest in recognisingthe _havemanifestly made [context ifit were available from the public sources 
body, and to facilitate interactions and interests, except where (achievements of Old Members, both within our  |public announcing the award/honour, where you chose 
communications between ourselves and the overridden by your data _|records and at a public level. to provide the information to us and (where 
relevant individuals. protection rights and relevant) consented to our publication of the 

freedoms same. 
19 [Subjects you studied and the type(s) of degree [We obtain this data from |For the purposes of ensuring that weinviteOld __ Permanently. Processingisnecessary for |We, and you, havea legitimate interest in N/A N/A 





awarded. 





the University of Oxford 
Weobtain this data from 
you 
Wegenerate this data 
about you 


Members back to relevant reunion events or 
to events they might be interested in, and to keep 
them up to date with news from their 
department(s). 








{the purposes of our or 
someone else's legitimate 
interests, except where 
overridden by your data 
protection rights and 





freedoms 





contacting you regarding relevant events and 
news. 




















